PoC Index

CVE-2026-41663

LOW 3.5EPSS 0.1%

Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because SameSite=Lax cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page. This issue has been patched in version 5.0.9.

CVSS v3.1
3.5 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
CVSS v3.1
3.5 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
EPSS
0.12% chance of exploitation in the next 30 days, 2th percentile
Published
2026-05-07

Proof-of-concept exploits (1)

References

Related